The Ηоmоgraph Illusion: Not Everything Is As It Seems
Summary: Unit 42 documented three in-the-wild email campaigns in which attackers swapped Latin letters for lookalike Cyrillic and Greek characters in display names, subjects, and sender addresses to impersonate a multinational financial services company, e-document signing platforms, and Spotify. The manipulated emails evaded built-in filters and reached target inboxes, with links leading to credential-harvesting pages that included custom CAPTCHAs and one-time-password prompts to screen out bots and crawlers.
What's compelling: The attack works because automated analysis reads Unicode values, not appearance, so a single substituted character can carry a message past filters that would otherwise flag the impersonation. In the DocuSign-style case, the target's own name and company name appeared in the lure, meaning the emails were built for specific recipients rather than sprayed broadly.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026